Active incident or hacked WordPress? Ransomware Hacked WordPress 423-888-0252 · 828-484-1257
Diversified Tech Solutions Diversified Tech Solutions Technology · Security · Compliance

What Is Eradication in Incident Response?

Definition

Eradication is the stage of incident response where you remove everything the attacker left behind (malware, backdoors, rogue accounts, stolen credentials) and close the weakness they used to get in. Done properly, it means the attacker cannot simply walk back in. It comes after containment and before or alongside recovery.

How It Works

CISA's incident response playbook sets a precondition before eradication starts: make sure every means of persistent access is accounted for, the activity is contained, and the evidence has been collected. Then the work typically includes:

  1. Remediate every affected environment, not just the first system you found. NIST stresses identifying all affected hosts.
  2. Reimage or rebuild systems from known-good ("gold") sources, or rebuild from scratch. CISA notes that rootkits can require rebuilding hardware.
  3. Replace compromised files with clean versions from the original vendor.
  4. Patch the hole the attacker used. Without this, the next scan finds you again.
  5. Reset passwords and secrets on affected accounts.
  6. Watch for a reaction. CISA warns that attackers often keep more than one backdoor and can "hop back into 'clean' areas" if eradication is rushed or incomplete. If new activity appears, you go back to containment and analysis.

CISA's #StopRansomware Guide adds a ransomware-specific trap: attackers often plant "dropper" malware first, so you must find it before rebuilding from backups or you restore the infection along with your data.

Real-World Example

In early 2021, hacking groups exploited zero-day vulnerabilities in on-premises Microsoft Exchange Server and installed webshells on thousands of servers. Many owners removed them, but by the end of March hundreds remained. On April 13, 2021, the Justice Department announced a court-authorized FBI operation that copied and then deleted one group's remaining web shells by sending each a command to remove itself. The announcement was careful about what that did not do: it did not patch the Exchange vulnerabilities, and it did not search for or remove any other malware or hacking tools the attackers may have placed through the web shells. Deleting the obvious foothold is one step of eradication, not the whole job.

Why It Matters for a Small Business

Incomplete eradication is why some businesses get hit twice by the same attacker. A website owner deletes the spam pages, but a second webshell or a hidden admin account stays behind, and the spam is back next week. An office restores from backup, but the backup was taken after the attacker planted their tools. Each repeat costs another round of downtime, cleanup fees, and customer trust. NIST also notes that once a resource is successfully attacked, it is often attacked again, so eradication has to include fixing the weakness, not just removing the symptoms.

How to Spot It / How DTS Handles It

Signs eradication was not finished: the same malware or spam returns, a deleted admin account reappears, files you removed come back, or logins continue from the attacker's addresses after passwords were changed.

On WordPress, DTS hunts for every persistence method before removing any of them: webshells, rogue admin users, database injections, modified core files, unexpected must-use plugins, recently changed PHP, .htaccess, and WordPress and server cron jobs, using wp core verify-checksums and wp plugin verify-checksums. With the owner's approval, we reinstall core, plugins, and themes from official sources, patch or remove the vulnerable component, rotate all passwords and salts, and monitor afterward. See our WordPress incident response package and the WordPress compromise checklist.

Related Terms

  • Containment: the step that must come first.
  • Recovery: what you do once the environment is clean.
  • Webshell: the most common thing left behind on a hacked website.
  • Backdoor: any hidden way back in, and the reason to hunt for more than one.
  • Rogue admin user: a WordPress persistence trick that survives a cleanup.
  • Patch management: closing the hole so the attacker cannot return.

Sources

  • CISA, Federal Government Cybersecurity Incident and Vulnerability Response Playbooks (Eradication and Recovery, p. 15): https://www.cisa.gov/resources-tools/resources/federal-government-cybersecurity-incident-and-vulnerability-response-playbooks
  • NIST, SP 800-61 Rev. 2, Computer Security Incident Handling Guide (Section 3.3.4, Eradication and Recovery; withdrawn April 3, 2025 and superseded by Rev. 3): https://csrc.nist.gov/pubs/sp/800/61/r2/final
  • U.S. Department of Justice, "Justice Department Announces Court-Authorized Effort to Disrupt Exploitation of Microsoft Exchange Server Vulnerabilities" (April 13, 2021): https://www.justice.gov/opa/pr/justice-department-announces-court-authorized-effort-disrupt-exploitation-microsoft-exchange
  • CISA and MS-ISAC, #StopRansomware Guide (Part 2, Detection and Analysis): https://www.cisa.gov/stopransomware/ransomware-guide

Last updated October 14, 2026.